Summary The Canadian-registered passenger hydrofoil SeaflightI, with eight passengers on board, was travelling up the lower Niagara River. Near the Youngstown Yacht Club mooring area, the vessel's rudder swung, uncommanded, hard to port. Despite attempts to regain steering control, the vessel veered to port and struck four pleasure craft moored off-shore. The SeaflightI was not damaged; however, one pleasure craft was sunk. No one was injured and there was no pollution. Ce rapport est galement disponible en franais. Other Factual Information The SeaflightI is a 138-passenger hydrofoil of welded aluminum alloy hull and superstructure. The forward and aft, upper and lower foils are constructed of stainless steel. The bridge is located forward and the machinery space aft. Main propulsion power is from two high-speed diesel engines driving highly skewed propellers through V-drive reduction gears. The SeaflightI departed Toronto on August 29 at 1800 eastern daylight time (EDT) 2 with eight passengers on a regularly scheduled voyage to Queenston, Ontario. The lake crossing was uneventful and the vessel crossed the Niagara River Bar and proceeded up the American side of the Niagara River at a speed of 33knots (kn). At 1858, as it was passing 60m off the mooring area of the Youngstown Yacht Club (YYC), the rudder swung uncommanded to port. The master, who had conduct of the vessel, switched to the backup steering pump and then the backup steering system. The mate put the engines full astern and began to sound the danger signal on the ship's horn; however, only three blasts of the horn were sounded before the SeaflightI entered the mooring area at an angle of approximately 45degrees. As the vessel approached the moorings, the master noted six people on board a yacht and purposely allowed the hydrofoil to continue to port to avoid striking this vessel, even though it meant colliding with four other unoccupied sailing yachts. The sailing yacht Awakin was damaged by the forward port lower foil and remained hung-up on foil before sinking in 21m of water approximately three minutes after the collision. Since then, the Awakin has been salvaged and declared a constructive total loss. No one was on board any of the moored vessels, and there were no injuries. The SeaflightI broadcast a Mayday call on very high frequency (VHF) channel16, as did the YYC tender HalfMoon. Canadian Coast Guard Search and Rescue boat CGR100 heard the distress call and arrived on the scene three minutes after the collision. The HalfMoon immediately proceeded to the SeaflightI to offer assistance and checked the other moored vessels involved in the collision for injured crew. Before the Awakin sank, the master of the tender noted that the main hatch was closed and locked from the outside, and that his manifest indicated that no person was on board. The SeaflightI was towed to an anchorage at the mouth of the Niagara River, where it was boarded and inspected by United States Coast Guard (USCG) inspectors. Inspection revealed that the electronic-hydraulic steering system would only function intermittently, and continually went hard to port. The electric-hydraulic backup system functioned correctly. At 2230 the passengers were transferred from the SeaflightI to the CGR100 and transported to their original destination at Queenston. The electronic-hydraulic steering system was still not functioning but the SeaflightI departed Youngstown at 2340 bound for Toronto, using the backup electric steering control system. At the time of the occurrence the wind was from the north-northwest at 10kn and visibility was approximately seven miles. The SeaflightI routinely used the American side of the Niagara River on her passages to Queenston because of complaints from the marinas on the Canadian side of the river. Although the SeaflightI leaves very little wake when travelling in the foil-borne mode, it is reported that an underwater shock wave radiates outwards from the vessel. When travelling in displacement mode, a large wake is left unless the vessel is slowed to dead slow ahead. Before the occurrence, the USCG had also received numerous complaints from American residents and boat owners, noting that the vessel passed consistently within 23m of the outer edge of the moorings. The USCG had conveyed these concerns in several letters to the hydrofoil's operator, the last being sent the day before the occurrence. Following the return voyage to Toronto, the operator's chief engineer, upon seeing the malfunction, indicated that he knew what the problem was and immediately went to the gyro room. There, he identified a control board in the electronic-hydraulic control system which showed signs of overheated diodes and replaced it with a spare. During sea trials of the vessel attended by the TSB and Transport Canada Marine Safety (TCMS) staff, this damaged board was put back into service; however, the problem did not recur. There are no domestic Canadian regulations for the inspection of high-speed vessels. Until regulations can be developed, the Board of Steamship Inspection has allowed the use of the Code of Safety for Dynamically Supported Craft (DSCCode), 3 and the International Code of Safety for High Speed Craft (HSCCode) for inspecting high speed craft.4 The DSC Code was prepared by the IMO in 1977 to facilitate research and development of dynamically supported craft so that they would be accepted internationally. It was predicated on the idea that the traditional method of regulating passenger ships should not be accepted as the only possible way of providing an appropriate level of safety. Over a period of 30 years, new vessel designs had been developed which could not fully comply with existing safety conventions. These vessels, however, had demonstrated an acceptable level of safety when operating on restricted voyages under approved maintenance and supervision schedules. The HSC Code was prepared by the IMO in 1994 as an update to the previous DSCCode. The safety philosophy of the HSCCode is based on the management of risk through accommodation arrangement, active safety systems, restricted operation, quality management, and human factors engineering. An example of this philosophy is the newest high speed craft to begin operation in Canada, the British Columbia Ferry Corporation's Pacificat Explorer. As a condition of her certification, the Pacificat Explorer is required to carry a route operational manual which, amongst other requirements, outlines safe voyage tracks for the vessel. Following a 1992 occurrence involving a collision between the high speed ferry Royal Vancouver and the conventional ferry Queen of Saanich, the TSB made several recommendations respecting: Passenger Safety (RecommendationsM94-23, M94-24, M94-25 and M94-26), and Operational Guidelines/Training (RecommendationsM94-27 and M94-28). TCMS agreed with the recommendations and, referring to the forthcoming HSCCode, indicated that the HSCCode deals with all aspects of ships such as the Royal Vancouver. As the HSCCode does not apply to vessels operating in the Great Lakes, TCMS inspected the vessel under the provisions of the older DSCCode, which did not require an approved route operational manual to be on board. TCMS did participate in sea trials during the two months prior to the vessel's certification, during which the vessel used the American side of the Niagara River without steering problems. The SeaflightI was certified to carry 138passengers and 5crew members on voyages across western Lake Ontario, not more than 23miles from a port of refuge. When travelling at full ahead in the foil-borne mode, operation of the vessel is restricted to conditions where wave heights are 3m or less. In this mode and at this speed, the vessel has a maximum stopping distance of 335m. The Permit to Operate a High Speed Craft (SIC54), issued 16June 1998, had expired 28August 1998 (the day before the occurrence) and, as a result, the vessel did not have a valid certificate at the time of the occurrence. Because hydrofoil technology is new to Canada, few ship's officers have experience in the operation of such vessels. Canada has not yet included high speed craft/dynamically supported craft (HSC/DSC) in the certification regulations. The vessel's owners have nonetheless voluntarily agreed to follow the HSCCode for crewing. The Ontario, Maritimes, and Western regions of TCMS are issuing HSC endorsements for masters, mates, and engineers. At the time of the occurrence, the ship's officers had been trained by Russian officers experienced in the operation of this type of vessel, and been issued appropriate HSC endorsements after examination by TCMS. Steering System The steering system on the SeaflightI consists of double-hydraulic rams powered by constant-flow hydraulic pumps mounted on the main engines. Normally, one pump is used, with a second pump available in the event of failure, or when the stabilizer flaps are in service. Steering control from the bridge consists of three systems: This system is used as the main steering and operates as a follow-up system, i.e., the rudder will move a distance corresponding to the movement of the wheel and then stop. An electronic signal from the bridge operates two solenoid valves in the steering compartment directing hydraulic fluid to the appropriate ram. An electric rudder-angle indicator sensor, mechanically linked to the tiller head, provides position information for the follow-up circuit and the bridge rudder-angle indicator. No alarm is fitted to indicate a loss of electrical power to the electronic control. When the vessel is travelling at speeds below 24kn, the rudder may travel up to its maximum of 35degrees port and starboard. As the vessel's speed increases beyond 18 kn, the rudder angle is limited to 10 degrees. This feature limits the hydrodynamic forces on the rudder to an acceptable level and ensures stability of the vessel while travelling at high speed in foil-borne mode. This system consists of two push buttons which, when pressed, directly energize the solenoid valves and direct fluid to the appropriate hydraulic ram. To operate this system, the main electronic steering is turned off and a toggle switch is actuated in the cockpit. A light indicates that the system is on. A second change-over switch is available in the steering flat (provided with a protective guard) and each solenoid valve has a manual push button to allow local control. Common to both the electronic and electric steering control systems are the solenoid valves, which direct hydraulic fluid to the appropriate cylinder upon receiving a signal from the bridge. A direct manual telemotor system is available using the wheel on the bridge. The wheel turns a rotary pump, which transmits a hydraulic signal directly to the steering rams. A direct manual telemotor system is available using the wheel on the bridge. The wheel turns a rotary pump, which transmits a hydraulic signal directly to the steering rams. The Steering Appliance and Equipment Regulations and the Machinery Regulations of the Canada Shipping Act provide detailed requirements for steering gear systems on Canadian vessels; however, the provisions of the Canada Shipping Act do not apply to hydrofoils such as the SeaflightI. Instead, TCMS inspected the vessel under the provisions of the DSCCode, which states in part: The administration should determine by demonstration any adverse effects upon safe operation of the craft in the event of uncontrollable total deflection of any one steering device, and should prescribe any limitation on the operation of the craft as may be necessary to ensure that the redundancy or safeguard in the systems provide equivalent safety. 5 The troubleshooting manual provided by the manufacturer of the steering control system indicates several possible scenarios which would cause the rudder to move hard over in either direction without warning: no pressure in the hydraulic system; faulty fuses in the Biryuza electronic steering control; faulty rudder-angle position sensor and feedback circuitry. In addition to these, the electronic steering control system is designed such that the rudder will swing uncommanded to starboard or port when the power is re-established after a momentary interruption. This is a self-test function of the steering system. The SeaflightI was tested for a period of two months prior to certification, without steering problems. However, tests conducted by TSB and TCMS representatives at sea on 23March 2000 confirmed that a power interruption for as little as one second will initiate this self-test and result in an uncommanded rudder movement of 10degrees to port or starboard. During high speed trials in foil-borne mode this uncommanded rudder movement resulted in the vessel sheering quickly off course. Tests conducted by simulating faulty fuses, however, did not result in rudder movement. The electronic steering control system of the SeaflightI has no audible power failure warning alarm, but is equipped with indicator lights for the availability of 220V and 27V steering control power. An alarm to indicate failure of the steering hydraulic system is provided; however, at the time of the occurrence, it did not sound. Inspection by the TSB also noted that the rudder-angle indicator operates only when power is applied to the main electronic or electric steering control systems. When control is switched to the manual backup steering, there is no rudder-angle indication. No written instructions for steering system change-over are displayed at the conning position on the bridge. Safety Action Taken In April 1999 a Marine Safety Advisory(MSA 04/99) was sent to TCMS describing several unsafe design characteristics of the steering control system installed on the SeaflightI and its sistership SeaflightII. In response, TCMS indicated that these unsafe characteristics will be examined in depth at the time of the annual inspection of the vessels. On 23 March 2000, sea trials were conducted on SeaflightI and its sister ship SeaflightII in the presence of TCMS and TSB representatives. The trials confirmed the propensity for the rudder to move uncommanded to port or starboard when the 220V steering control power is re-established following an interruption of as little as one second. It was demonstrated that such an interruption could result from the power being manually switched off, on the bridge or in the electrical control room, or from a failure of the motor-generator supplying the system. Subsequently, TCMS has required that the vessel's owners install an audible alarm on the bridge to indicate failure of the 220V steering control power supply. Tests conducted by removing the various power fuses associated with the failure modes in the service manual did not result in a rudder movement. Subsequent to several occurrences involving HSC, TCMS had concerns regarding the safety of these operations. As a result, TCMS Ontario Region produced a report entitled High Speed Craft Operations on Lake Ontario during 1998. This report recommended, inter-alia, that: Speed trials to be conducted to determine appropriate maximum speed in the displacement mode that will minimize wake. TCMS has specifically endorsed the certificate of SeaflightI requiring that only the electric-hydraulic or the manual hydraulic steering control systems be used when the vessel is in confined waters. TCMS has specifically endorsed the certificate of SeaflightI requiring that only the electric-hydraulic or the manual hydraulic steering control systems be used when the vessel is in confined waters. There should be instructions regarding the particular voyage the vessel is engaged on in the vessel's Operations Manual. The vessel's operators report that steering tests are now conducted using all steering control systems six miles before entering the Niagara River and that the vessel will transit the YYC mooring area in displacement mode. Additionally, representatives of the vessel's builders have modified the steering system to limit the rudder angle to 10degrees while operating in the electronic steering mode, regardless of speed.